Parameter · Connections and Authentication / SSL
ssl_prefer_server_ciphers
Give priority to server ciphersuite order.
- Default:
on - Type: bool
- Applies: Reload
In plain words
When client and server both support several cipher suites, someone has to choose. With this on (default), the server's preference order wins, which is usually better because the server is configured deliberately.
For DBAs and operators
Maps to OpenSSL's SSL_OP_CIPHER_SERVER_PREFERENCE. It mainly matters for TLS 1.2 and lower, where the order of ssl_ciphers decides. It exists for backward compatibility with PostgreSQL before 9.4, which always used the client's order. There is rarely a reason to turn it off; doing so lets a misconfigured or old client pick a weak suite from the allowed list. Observe the result in pg_stat_ssl.cipher.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().